AMENDMENTS TO THE CLAIMS 

The following listing of claims will replace all prior versions and listings of claims 
in the application. 

Listing Of Claims 

Cancel claims 1 -3 

4. (Currently Amended) A security administration server as cla i med i n claim 
3, whoroin installed in a predetermined LAN, comprising : 

means for collecting information relating to communication conducted via said 
LAN bv a device to be monitored operating in said LAN: 

means for generating an image bv extracting information useful for securitv 
management in said LAN from said collected communication related information and 
visualizing said information to a predetermined form: 

means for sending said image to a monitoring device wherein: 

said LAN is connected to an external network such as the Internet; and 
said image generating means comprises means for generating an image 
visualizing into respective predetermined objects simultaneouslv , said device to be 
monitored, a device operating in said external network which communicates with said 
deice to be monitored, a user using said devices, and communication conducted 
between each dovico said devices inside and outside of said LAN. 
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5. (Currently Amended) A security administration server as claimed in claim 
4, wherein 

said image generating means comprises means for dividing in groups each of 
said objects according to predetermined standards, and for generating an image 
visualizing each group in layers. 

6. (Currently Amended) A security administration server as claimed in claim 
[[5]] 4, wherein said standard is based on reliability between each device and said LAN. 

7. (Previously Presented) A security administration server as claimed in 
claim 6, wherein: 

said image generating means comprises a function for generating an image 
structured with an area displaying a text message as it is, an area displaying as a graph 
an appearance frequency of a predetermined character string in said log information, an 
area displaying as a graph an appearance frequency of said character string for each 
predetermined unit time period in a time series, and an area displaying as a graph the 
length of each line of said text message, based on a log information structured with 
describing various processes conducted in each of said devices to be monitored in a 
text message format including such content and execution time and date in separate 
lines. 

8. (Previously Presented) A security administration server as claimed in 
claim 7, wherein 
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said device to be monitored comprises: 

means for managing a log file which is the entity of the log information in the form 
of an original file and a plurality of duplicate files thereof managed with the same 
contents as said original file in real time, and for storing and managing each file 
distributed to a plurality of storing places suitably defined in a storing means in said 
device to be monitored; 

means for suitably transferring each duplicate file to another said storing place; 

means for detecting whether or not there is an abnormality in security in both of 
said original and duplicate log files; and 

means for notifying said security administration server when an abnormality is 
detected of such fact and/or its content; 

wherein said image generating means comprises means for reflecting in said 
image a fact and/or its content of detecting said abnormality notified from said device to 
be monitored. 

9. (Previously Presented) A security administration sever as claimed in 
claim 8, comprising: 

means for receiving an updating data sent from a predetermined computer 
operating in said external network; and 

means for updating a content of a software providing said image generating 
means by said updating data. 
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10. (Previously Presented) A security administration serer as claimed in claim 
9, comprising means for transmitting and receiving said collected log information to and 
from said computer by communicating with said predetermined computer operating In 
said external network. 

11. (Previously Presented) A security administration server as claimed in 
claim 10, comprising: 

means for storing and managing various setting-registration information such as 
information of said device to be monitored from which said log information is collected, 
and information used and/or referred to by said image generating means; and 

means for transmitting and receiving said setting-registration information to and 
from said computer by communicating with said predetermined computer operating in 
said external network. 

12. (Previously Presented) A security administration server as claimed in 
claim 1 1 , comprising: 

means for detecting an abnormality in security of said device to be monitored or 
said security administration sen/er itself, by communicating with a predetermined 
computer operating in said external network, based on said collected log information 
and log information of said security administration server stored and managed by itself; 
and 

means for transmitting and receiving to and from said computer when an 
abnormality is detected of such fact and/or its content. 
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13. (Previously Presented) A security administration server as claimed in 
claim 12, comprising: 

means for communicating based on a TCP/IP protocol with each device to be 
monitored; 

means for allocating predetermined IP addresses according to a request from 
each device to be monitored in said LAN as well as for storing and managing allocated 
histories describing histories of corresponding said IP addresses and MAC addresses of 
each device to be monitored; 

means for storing and managing said collected communication related 
information attached with an IP address specifying which said deice to be monitored 
said communication related information concerns; 

means for handling said communication related information attached with IP 
addresses corresponded to a same MAC address in said allocated history, as a 
communication related information regarding the same said device to be monitored. 

14. (Currently Amended) A security administration server as claimed in claim 
13, comprising: 

means for mutually transmitting and roco i v e receiving said allocated history to 
and from other security administration servers operating in said LAN; and 

means for integratedly managing said allocated history in another security 
administration server that is received, and said allocated history stored and managed by 
said server itself, and to handle said communication related information attached with IP 
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addresses corresponding to a same MAC address in respect to these allocated 
histories, as a communication related information regarding the same device to be 
monitored. 

15. (Currently Amended) A security administration server as claimed in claim 
[[13 or]] 14, comprising means for specifying a MAC address wherein each combination 
of a MAC address and an IP address described corresponding to said allocated history 
is attached with a valid period information of said IP address, said valid period 
information and a generated time and date of said communication related information 
recorded and attached to said collected communication related information are 
compared, and a MAC address corresponding to an IP address attached to said 
communication related information at said generated time and date is specified. 

16. (Original) A host server functioning as said predetermined computer in 
claim 9, comprising means for suitably sending said updating data to said security 
administration server. 

17. (Original) A host sen/er functioning as said predetermined computer in 
claim 10, comprising means for storing and managing said communication related 
information sent from said security administration sen/er. 
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18. (Original) A host server as claimed in claim 17, comprising means for 
sending said communication related information which is stored and managed to said 
security administration server. 

19. (Currently Amended) A host server as claimed in claim [[17 or]] 18, 
comprising: 

means for detecting an abnormality in security regarding said device to be 
monitored based on said communication related information which is stored and 
managed; and 

means for sending to a security administration server installed in a relevant LAN 
of the fact and/or its content when an abnormality is detected. 

20. (Previously Presented) A host server as claimed in claim 19, comprising 
means for receiving said various setting information sent from said security 
administration server, or the fact and/or its content of detecting said abnormality and for 
storing and managing such information. 

21 . (Previously Presented) A host server as claimed in claim 20, comprising: 
means for communicating with a portable telephone via the Internet or a 

telephone network; and 

means for reporting to a predetermined portable telephone by a voice call or an 
electronic mail, of the fact and/or its content when the host server itself detects an 
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abnormality, or the fact and/or its content of detecting said abnormality sent from said 
security administration server. 

22. (Previously Presented) A host server as claimed in claim 21 , comprising: 
means for communicating with a portable telephone via the Internet; 

means for receiving an inquiry message regarding said communication related 
information sent from a predetermined portable telephone; 

means for retrieving said communication related information corresponding to 
said inquiry message from said communication related information which is stored and 
managed; and 

means for sending a message described with such retrieved result to said 
portable telephone. 

23. (Previously Presented) A host server as claimed in claim 22 comprising: 
means for communicating with a portable telephone via the Internet; 

means for receiving information specifying said device to be monitored sent from 
a predetermined portable telephone and a processing command executed in said 
device; 

means for sending said processing command to a device specified by said 
specifying information via the Internet; 

means for receiving an execution result of said processing command sent from 
said device, for editing said execution result to an image of a form suitable for a user 
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interface of said portable telephone, and for sending such image to said portable 
telephone. 

24. (Previously Presented) A security administration server as claimed in 
claim 23, comprising means for collecting communication packets, wherein said 
communication related information is communication packets flowing in said LAN. 

25. (Original) A security administration server as claimed in claim 24, 
comprising means for directly obtaining said communication packets via said LAN. 

26. (Currently Amended) A security administration server as claimed in claim 
[[24 or]] 25, comprising means for concentrating via said LAN communication packets 
which are obtained by said device to be monitored operating in said LAN and stored 
and managed in said device to be monitored. 

27. (Previously Presented) A security administration server as claimed in 
claim 26, comprising: 

means for calculating at least one portion of a value of the number of said 
devices to be monitored or a number totaling the number of devices into predetermined 
groups, a number of communication packets transmitted and received by said device to 
be monitored via said LAN, and a number totaling such number of communication 
packets in predetermined groups; and 
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means for generating an image visually expressing a value of at least one portion 
of each calculated value and for sending said image to said device to e monitored which 
is connected to via said LAN. 

28. (Previously Presented) A security administration server as claimed in 
claim 27, comprising: 

means for storing and managing access-limitation information in respect to said 
device to be monitored; 

means for monitoring unauthorized access violating said access-limitation 
information based on said communication packets; and 

means for generating an image visually expressing the effect when recognizing 
said unauthorized access and sending said image to said monitor device. 

29. (Previously Presented) A security administration server as claimed in 
claim 28, comprising: 

means for storing and managing access authorization information for each 
system operating in said device to be monitored; 

means for monitoring unauthorized access violating said access authorization 
information based on said communication packets; 

means for generating an image expressing the fact of when an access violating 
said access authorization information is recognized; and 

means for sending said image to said monitoring device. 
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30. (Previously Presented) A security administration server as claimed in 
claim 29, comprising means: 

for generating an image by drawing an image visualizing communication 
conducted between each of said devices to be monitored or an access situation of a 
user of each device to be monitored based on said communication packets and an 
access situation from each device to be monitored or a user to a database operating in 
each device to be monitored, as overlapping an image where an abstract design of 
each device operating in said LAN is disposed to form according to an actual 
arrangement state of each device; and 

for sending said image to said monitoring device. 

31. (Previously Presented) A security administration server as claimed in 
claim 30, comprising means for detecting a use history of said device to be monitored of 
each user using said device to be monitored based on said communication packets and 
sending an image describing said use history to said monitoring device. 

32. (Previously Presented) A security administration server as claimed in 
claim 31 , comprising: 

means for totaling the number of communication packets transmitted and 
received to and from said device to be monitored which is examined based on said 
communication packets, for each system operating in said device to be monitored; 

means for generating an image visualizing said totaled value for each system; 

and 
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means for sending said image to said monitor device. 

33. (Previously Presented) A security administration server as claimed in 
claim 32, comprising: 

means for examining an operating state of said device to be monitored based on 
said communication packets; 

means for generating an image visualizing an operating state of each device to 
be monitored by classifying into each system operated by using said device to be 
monitored; and 

means for sending said image to said monitoring device. 

34. (Previously Presented) A security administration server as claimed in 
claim 33, comprising: 

means for detecting an access frequency to a database operated by said device 
to be monitored based on said communication packets; 

means for generating an image visualizing by classifying for each device to be 
monitored or for each system operated by using said device to be monitored; and 

means for sending said image to monitoring device. 

35. (Previously Presented) A security administration server as claimed in 
claim 34, comprising: 

means for collecting via the LAN execution histories of a program in said device 
to be monitored which is accumulated and recorded in said device to be monitored; 
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means for generating an image visualizing an execution history of a program in 
said device to be monitored based on said execution history; and 
means for sending said image to said monitoring device. 

Cancel claims 36 and 37. 

38. (Currently Amended) A security administration server as c l aimed i n c l a i m 36 
or 37, installed in a LAN connected to an external network such as the Internet, 
comprising: 

means for passivelv or activelv collectino loo information stored and managed bv 
a device operating in said LAN: 

means for generating an image visualizing information to a predetermined form, 
where said information is extracted as useful for securitv management in said LAN from 
said collected log information: 

means for passivelv or activelv sending said image to another device via said 

LAN: 

wherein said image generating means comprises means for generating an image 
visualizing as respective predetermined objects, said device operating in said LAN, a 
device operating in said external network communicating with said device, a user using 
both said devices, and communication conducted between each device inside and 
outside of said LAN. 
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39. (Original) A security administration server as claimed in claim 38 wherein 
said image generating means comprises means for dividing each object into groups 
according to a predetermined standard, and generate an image visualizing each group 
in layers. 

40. (Original) A security administration server as claimed in claim 39, wherein 
said standard is based on reliability between various devices and said LAN. 

41. (Previously Presented) A security administration sen/er as claimed in 
claim 40, wherein: 

said image generating means comprises a function for generating an image 
structured with an area displaying a text message as it is, an area displaying as a graph 
an appearance frequency of a predetermined character string in said log information, an 
area displaying as a graph an appearance frequency of said character string for each 
predetermined unit time period in a time series, and an area displaying as a graph the 
length of each line of said text message, based on a log information structured with 
various processes conducted in each device described in separate lines in a text 
message format including such content and executing time and date. 

42. (Previously Presented) A security administration server as claimed in 
claim 41 , wherein 

said device operating in said LAN comprises: 
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means for managing a log file which is the entirety of the log information in the 
form of an original file and a plurality of duplicate files thereof managed with the same 
contents as said original file in real time; and 

means for storing and managing each file distributed to a plurality of storing 
places suitable defined in a storing means in said device; 

means for suitably transferring each duplicate file to another storing place; 

means for detecting whether or not there is an abnormality in security in both of 
said original and duplicate log files; and 

wherein image generating means comprises means for reflecting in said image 
the fact an/or its content of detection of said abnormality notified from said device. 

43. (Previously Presented) A security administration sen/er as claimed in 
claim 42, comprising: 

means for receiving an updating data sent from a predetermined computer 
operating in said external network; and 

means for updating a content of a software providing said image generating 
means by said updating data. 

44. (Previously Presented) A security administration server as claimed in 
claim 43, comprising means for transmitting and receiving actively or passively said 
collected log information to and from said computer by communicating with a 
predetermined computer operating in said external network. 
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45. (Previously Presented) A security administration sender as claimed in 
claim 44, comprising: 

means for storing and managing various setting-registration information such as 
information regarding said device operating in said LAN which is to be an object of 
collecting said log information and information used and referred to by said image 
generating means; and 

means for transmitting and receiving said setting-registration information actively 
or passively to and from said computer by communicating with a predetermined 
computer operating in said external network. 

46. (Previously Presented) A security administration sen/er as claimed in 
claim 45, comprising: 

means for detecting an abnormality in security of said device or said security 
administration server itself by communicating with a predetermined computer operating 
in said external network, based on said collected log information and a log information 
of said security administration server stored and managed by itself; and 

means for transmitting and receiving actively or passively to and from said 
computer the fact and/or its content when an abnormality is detected. 

47. (Previously Presented) A security administration sender as claimed in 
claim 46, comprising: 

means for communicating based on a TCP/IP protocol with each device in said 

LAN; 
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means for allocating predetermined IP addresses according to a request from 
said device in said LAN as well as for storing and managing allocated histories 
describing histories of corresponding said IP addresses and MAC addresses of said 
devices; 

means for storing and managing said collected log information by attaching an IP 
address specifying which device said log information concerns; 

means for handling said log information attached with IP addresses 
corresponded to a same MAC address in said allocated history, as log information 
regarding the same device. 

48. (Original) A security administration server as claimed in claim 47, 
comprising: 

means for mutually transmitting and receive said allocated history to and from 
another security administration server operating in said LAN; and 

means for integratedly managing said receives allocated history in another 
security administration server, and said allocated history stored and managed by itself, 
and for handling said log information attached with IP addresses corresponding to a 
same MAC address in respect to said allocated histories, as a log information regarding 
the same device. 

49. (Currently Amended) A security administration server as claimed in claim 
[[47 or]] 48 comprising means for specifying a MAC address wherein each combination 
of MAC address and an IP address described corresponding to said allocated history is 
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attached with a valid period information of said IP address, said valid period information 
and a generated time and date of said log information recorded attached to said 
collected log information are compared, and a MAC address corresponded with an IP 
address attached to said log information at said generated time and date is specified. 

50. (Original) A host server functioning as said predetermined computer in 
claim 43, comprising means for suitably sending said updating data to said security 
administration server. 

51. (Original) A host server functioning as said predetermined computer in 
claim 44, comprising means for storing and managing said log information sent from 
said security administration server. 

52. (Original) A host server as claimed in claim 51, comprising means for 
sending actively or passively said log information which is stored and managed to said 
security administration server. 

53. (Currently Amended) A host server as claimed in claim [[51 or]] 52, 
comprising: 

means for detecting an abnormality in security of said device in said LAN based 
on said log information which is stored and managed; and 

means for sending to a security administration server installed in a relevant LAN 
the fact and/or its content when an abnormality is detected. 
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54. (Previously Presented) A host server as claimed in claim 53, comprising 
means for actively or passively receiving said various setting information sent from said 
security administration server or the fact and/or its content of detecting said abnormality 
and fro storing and managing such information. 

55. (Previously Presented) A host server as claimed in claim 54, comprising: 
means for communicating with a portable telephone via the Internet or a 

telephone network; and 

means for reporting to a predetermined portable telephone by a voice call or an 
electronic mail, the fact and/or its content when the host server itself detects an 
abnormality or the fact and/or its content of detecting said abnormality sent from said 
security administration server. 

56. (Previously Presented) A host server as claimed in claim 55, comprising: 
means for communicating with a portable telephone via the Internet; 

means for receiving an inquiry information regarding said log information sent 
from a predetermined portable telephone; 

means for retrieving said log information corresponding to said inquiry message 
from said log information which is stored and managed; and 

means for sending a message describing said retrieved result to said portable 
telephone. 
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57. (Previously Presented) A host server as claimed in claim 56, comprising: 
means for communicating with a portable telephone via the Internet; 

means for receiving information specifying said device operating in said LAN sent 
from a predetermined portable telephone and a processing command executed in said 
device; 

means for sending said processing command to a device specified by said 
specifying information via the Internet; 

means for receiving an execution result of said processing command sent from 
said device for editing said execution result to an image of a form suitable for a user 
interface of said portable telephone and for sending such image to said portable 
telephone. 

58. (New) A security administration server as claimed in claim 4, comprising: 
means for detecting an abnormality in security of said device to be monitored 

based on said communication related information, and 

means for making said image reflect information to that effect and/or its content 
when the abnormality is detected. 

59. (New) A security administration sen/er as claimed in claim 4, comprising 
means for collecting log information via said LAN, wherein said communication related 
information is log information stored and managed in said device to be monitored. 
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60. (New) A security administration server as claimed in claim 38 comprising: 
means for detecting an abnormality in security of a device operating in said l-AN 

based on said collected log information; and 

means for making said image reflect information to that effect and/or its content 

when the abnormality is detected. 
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